Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel platforms from 2008 onwards have a remotely exploitable security hole

semiaccurate.com

Post reply on HN
Print view View original

81–90 of 190 posts

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#81

Post by hdhzy »

elorant wrote: post #68
the_common_man wrote: post #59

Earlier quoted context omitted.

How do you disable it? In the BIOS? Is it enabled by default?

I'm running Windows and I just disabled the service. There are a couple of them, one is Local Management Service and the other is User Notification Service.

ME is a separate chip running alongside main CPU. You can't disable it via Windows services :)

I recommend Platform Embedded Security Technology Revealed book [0] from designers and creators of ME for further information.

[0]: https://link.springer.com/book/10.1007/978-1-4302-6572-6

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#82

Post by mschuster91 »

woodrowbarlow wrote: post #57
mschuster91 wrote: post #54

Earlier quoted context omitted.

Partially. Expansion cards use PCI-E which has DMA capability, so a bug/backdoor in their firmware can very well be used to attack a system. But I believe newer systems with MMUs acting as "firewalls" for DMA are safe from this vector.

there's also the concern of physical attacks, via the motherboard's RJ45 or USB.

At least USB doesn't have device-initiated DMA, but USB descriptor parsing bugs have in the past led to exploits (I remember the PlayStation jailbreak).

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#83

Post by SEJeff »

AdmiralAsshat wrote: post #10

The short version is that every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware. We knew this would happen. We knew that the Management Engine was a backdoor, and we knew it was only a matter of time before someone would figure out how to exploit it. This is exactly the reason why Libreboot exists (…

This is also what the management engine cleaner project is for:

https://github.com/corna/me_cleaner

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#84

Post by School-Cotton »

tormeh wrote: post #62
freehunter wrote: post #58

Earlier quoted context omitted.

The fact that people can stay behind platforms, companies, and technologies that are proven to be so inherently insecure that they can never be trusted just boggles my mind. Adobe Flash has a new zero-day every week, but we were saddled with it for years past when it should have been retired because some people didn't want HTML5 to have feature-parity with Flash. Java has a new zero-day every week but we're stuck wit…

>Java has a new zero-day every week but we're stuck with it Well, Java applets did die. What more do you want? The Java sandbox is only used by extremely legacy software at this point, so it doesn't matter if it has holes in it. Actually, the more holes the better, so we can get rid of the last holdouts.

Java is the most widely-used programming language in the world. Applets are an insignificantly tiny drop in the bucket of what Java is used for.

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#85

Post by dewyatt »

frik wrote: post #71
AdmiralAsshat wrote: post #10

The short version is that every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware. We knew this would happen. We knew that the Management Engine was a backdoor, and we knew it was only a matter of time before someone would figure out how to exploit it. This is exactly the reason why Libreboot exists (…

Let's hope one of the other CPU manufacturers (e.g. AMD) starts supporting LibreBoot and allows to officially disable the ME-equivalent hardware feature, so that Intel get's forced by market-pressur to follow. Intel needs more competition - thanks to AMD latest new 8-core CPU Intel got forced to release a new CPU the had in their basement for years - suddently it's possible for them to release i7 notebook CPUs with m…

That was the top request in their March AMA:

https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea...

I wouldn't hold my breath, though.

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#86

Post by semi-extrinsic »

frik wrote: post #71
AdmiralAsshat wrote: post #10

The short version is that every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware. We knew this would happen. We knew that the Management Engine was a backdoor, and we knew it was only a matter of time before someone would figure out how to exploit it. This is exactly the reason why Libreboot exists (…

Let's hope one of the other CPU manufacturers (e.g. AMD) starts supporting LibreBoot and allows to officially disable the ME-equivalent hardware feature, so that Intel get's forced by market-pressur to follow. Intel needs more competition - thanks to AMD latest new 8-core CPU Intel got forced to release a new CPU the had in their basement for years - suddently it's possible for them to release i7 notebook CPUs with m…

What are you on about? I had a 4-core i7 in my laptop back in 2013, an i7-3920XM IIRC:

https://ark.intel.com/products/64887/Intel-Core-i7-3920XM-Pr...

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#87

Post by tomku »

codedokode wrote: post #77
tomku wrote: post #9

Is there a better source for this than SemiAccurate? The article doesn't really have much beyond self-aggrandizement and "we can't tell you any details, but you're screwed". For something that could be anything from "Charlie Demerjian heard a rumor about a ME patch and wanted some pageviews" to the actual security apocalypse, I'd like credible sources.

If Intel released a firmware update, then anyone can compare this update to a previous version and see what has changed.

That's harder in practice than you make it sound. Firmware updates for Intel ME are handled through OEMs, it's not a file that Intel publishes that an interested person can go to their website and download. The article claims that such a patch has been released to OEMs but is being kept under wraps, which might make it hard to determine when it actually ships in a downstream update. Even if you have a file that you know contains the binary blob of updated firmware, reverse-engineering it to determine what it does differently compared to the previous version is very much non-trivial.

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#88

Post by codedokode »

tomc1985 wrote: post #43

What is the motivation behind Management Engine? From the perspective of an everyday user these things came out of nowhere to evolve into this para-computer running along side me that I cannot see and have no control of. It is on literally ALL hardware Why is it that any attempts to disable it knock your whole computer out? And this is the world of technology that we want? I'm so sick of technology companies appearin…

I think the problem is not that this technology exists but rather that the operation of this engine is not transparent, the user cannot examine or disable the software in this engine, cannot write his own software.

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#89

Post by phkahler »

jnwatson wrote: post #52
tomc1985 wrote: post #43

What is the motivation behind Management Engine? From the perspective of an everyday user these things came out of nowhere to evolve into this para-computer running along side me that I cannot see and have no control of. It is on literally ALL hardware Why is it that any attempts to disable it knock your whole computer out? And this is the world of technology that we want? I'm so sick of technology companies appearin…

The functionality ME attempts to provide is lights out a.k.a. out-of-band management (like IPMI) to the desktop. If, for example, an admin needed to add a dual-boot-to-Ubuntu option to every PC on a floor, he could, through ME, remotely reboot (force power reset if necessary) or power on every machine, have the machines boot to a (remote) OS install disk, run the install, and reboot. ME allows one to do almost anythi…

Can't all that be done from the main OS? Repartition, modify the boot stuff, reboot from an image in a new partition, etc... Why did they need to add another processor with closed source and all the potential security issues?

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#90

Post by pasbesoin »

ymse wrote: post #53
imode wrote: post #15

I've got a Lenovo T530 and a Lenovo T450s. I wonder if they've released a firmware update yet...? I can't say I'm surprised, but I am surprised at the fact that finally, after all these years, someone finally got down to patching some vulnerabilities in this area. props to whomever forced Intel's hand.

One nice feature of (some) Thinkpads is that the AMT and ME can be "permanently disabled" through the BIOS, presumably by blowing a fuse or similar. Check if yours has this capability. Otherwise check for updates at http://pcsupport.lenovo.com .

Hopefully, someone can speak further to whether this is a real mitigation and what "permanently" and "disabled" really mean, in this specific context.

I'm don't mean to sound oppositional. I appreciate this being mentioned.

I'm just not willing to trust it without knowing in detail that and how it works.

Post reply on HN